# Setting new Transmuter will completely break internal storage of AlchemistV3.sol

setTransmuter requires direct yield-token funding that bypasses redeem(), leaving totalDebt, totalSyntheticsIssued and cumulativeEarmarked stale, corrupting accounting and enabling wrongful full liquidation.

- Payout: Contest reward
- Severity: medium
- Program: Alchemix
- Credited: T1MOH
- Disclosed: 2025-07-15
- Write-up quality: 6/10
- Original: https://cdn.cantina.xyz/reports/cantina_competition_alchemix_may2025.pdf#3.2.20
- Library page: https://bugbountylibrary.com/r/cantina%3Aalchemix_may2025%3A3.2.20
- Tags: domain:web3 impact:funds-loss kind:contest platform:cantina sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:business-logic vuln:liquidation

**Target:** AlchemistV3.sol setTransmuter / Transmuter accounting
**Root cause:** setTransmuter's solvency check forces admins to send yield tokens directly to the old Transmuter instead of calling redeem(), so totalDebt, totalSyntheticsIssued, cumulativeEarmarked and _redemptionWeight are never decremented.
**Steps:**
1. Admin calls `setTransmuter(newAddr)`; check requires `convertYieldTokensToDebt(balanceOf(yieldToken, transmuter)) >= IT transmuter.totalLocked()`.
2. To satisfy it, admin transfers yield tokens directly to the old Transmuter (no `redeem()` call).
3. Observe `totalDebt`, `totalSyntheticsIssued`, `cumulativeEarmarked` remain inflated; `_redemptionWeight` stays too low.
4. `calculateLiquidation` sees inflated debt vs collateral, and `alchemistCurrentCollateralization < alchemistMinimumCollateralization` triggers full liquidation of positions.
**How found:** Code review of setTransmuter's solvency requirement revealed the only funding path is a direct transfer, then traced which redeem()-only state updates (totalDebt, totalSyntheticsIssued, cumulativeEarmarked, _redemptionWeight) are skipped and how calculateLiquidation consumes them.
**Exploitation:** Governance-driven: after a legitimate transmuter swap funded by direct transfer, the system's totalDebt overstates real debt, so liquidation logic fully liquidates positions that should not be liquidated.
**Escalation:** Discrepancy scales with the size of the direct transfer required to cover pending redemptions, turning a griefing-level mismatch into systemic wrongful liquidation.
**Insight:** When an admin function enforces a solvency invariant via raw balance checks, verify whether the sanctioned funding path bypasses the accounting updates normally performed by the redeem/withdraw function; stale aggregate counters can flip liquidation thresholds.